Security researchers have published a Proof-of-Concept (PoC) exploit for a critical vulnerability in the widely used PuTTY SSH and Telnet client.
The flaw, CVE-2024-31497, allows attackers to recover private keys generated with the NIST P-521 elliptic curve in PuTTY versions 0.68 through 0.80.
The vulnerability stems from PuTTY’s biased generation of ECDSA nonces when using the P-521 curve.
Researchers found that the first 9 bits of each nonce are always zero, enabling full private key recovery from roughly 60 signatures using lattice cryptanalysis techniques.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
To demonstrate the feasibility of the attack, security researcher Hugo Bond published a PoC exploit on GitHub.
The PoC leverages the nonce bias to recover the private key from a set of signatures generated by a vulnerable PuTTY version.
An attacker could obtain the required signatures in several ways, such as setting up a malicious SSH server and capturing signatures from connecting PuTTY clients, or extracting signatures from signed Git commits or other sources where PuTTY was used as an SSH agent.
The vulnerability affects not only the PuTTY client, but also several other popular tools that incorporate vulnerable PuTTY versions, including:
- FileZilla 3.24.1 – 3.66.5
- WinSCP 5.9.5 – 6.3.2
- TortoiseGit 2.4.0.2 – 2.15.0
- TortoiseSVN 1.10.0 – 1.14.6
PuTTY developers have released version 0.81 to address the flaw, and patched versions are available for most of the affected third-party tools as well.
However, the attack can still be carried out if an attacker possesses around 60 signatures generated with a vulnerable version.
Therefore, any NIST P-521 keys used with PuTTY or related tools should be considered compromised and immediately revoked.
As PuTTY is one of the most popular SSH clients, especially on Windows, this vulnerability has a wide-reaching impact.
All users are advised to upgrade to patched versions as soon as possible and replace any potentially exposed keys.
The publication of a PoC exploit increases the likelihood of threat actors exploiting this flaw in the wild.
Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide